RFC: Enhanced Console Verbosity/Logging

[adfoster-r7]

Problem

Metasploit currently provides many settings to configure the logging levels for modules:

• set Verbose true
• set DEBUG true
• set HttpTraceHeadersOnly true
• set HttpTrace true
• setg LogLevel 3

It’s not always clear what options should be set for a particular module to gain useful debugging output, or that a user can set these values to begin with.

Meterpreter tracing improvements

We can update Metepreter to additional print its debug output to Metasploit's msfconsole/meterpreter console. Potentially this could be spool'able to a separate file for grep'ing purposes.

We might have to compile an additional separate binary for the Windows Meterpreter with the DEBUGTRACE flag set, and conditionally send the debug binary to the target host. This would require changes to our build setup.

Potential solutions

Additional verbose flags could be added to the run/check commands as a quick means to enable increased levels of logging. This is currently the approach chosen by many tools and should intuitive to the user.

For example, the initial buckets could be:

• run -v - enable verbose mode
  • Enables the current verbose mode, which is currently configurable with set verbose true
  • Log high level request/response information for protocols.
  • HTTP request/response information - URLs / IPs / status codes
  • High level SMB details
• run -vv - enabling more granular logging
  • Full protocol information is logged
  • Full HTTP request/responses
  • Full SMB details
• run -vvv- Insanity logging
  • Detailed logging is enabled
  • Debug logging from meterpreter - Feature Request - HTTP(s) logs #14231
  • Although not currently supported by metasploit-framework, this option could include wireshark-esque capabilities.

The above approach may not be granular enough, and as a result may not align with the user's expectations. For instance, a user may want detailed logging in one area, but not in another. An alternative solution is to prefix the available options that could provide improved logging with a set prefix, for example VERBOSE_, i.e. VERBOSE_HTTP_TRACING, VERBOSE_METERPRETER_TRACING etc. This naming convention would allow a user to easily discover the available options that are available within the console via set VERBOSE_<tab>.

[smcintyre-r7]

Another diagnostic capability that we should consider is the ability to debug payloads. Right now the different meterpreter implementations also have different steps to enable logging (different datastore options, invocation techniques, etc.) that could be unified as well. This would reduce the documentation we'd need to write and maintain for troubleshooting payloads. This might require shipping debug builds of the payload binaries however. If we ship debug payload binaries we should be careful that users can not easily enable them by accident.